HyperText Transfer Protocol (HTTP) is stateless. Hence, all HTTP requests are stateless. That means it does not remember anything or any user we have authenticated, and our application wouldn't know whether it is the same person from the previous request. So, we would have to authenticate again on the next request. This is not ideal.
So, session-based and cookie-based authentication (usually referred to only as session-based authentication) were introduced to store user data between HTTP requests to put away the stateless nature of HTTP requests. They make the authentication process "stateful." That means an authenticated record or session is stored on both the server and client sides. The server can keep the active sessions in a database or the server memory, thus it is known as session-based authentication. The client can create a cookie to hold the session identifier (session ID), so it is known as cookie-based authentication...
